BILL NUMBER: SB 1903	CHAPTERED  09/30/00

	CHAPTER   1066
	FILED WITH SECRETARY OF STATE   SEPTEMBER 30, 2000
	APPROVED BY GOVERNOR   SEPTEMBER 30, 2000
	PASSED THE SENATE   AUGUST 31, 2000
	PASSED THE ASSEMBLY   AUGUST 30, 2000
	AMENDED IN ASSEMBLY   AUGUST 29, 2000
	AMENDED IN ASSEMBLY   JULY 6, 2000
	AMENDED IN ASSEMBLY   JUNE 22, 2000
	AMENDED IN SENATE   APRIL 24, 2000

INTRODUCED BY   Senator Speier

                        FEBRUARY 24, 2000

   An act to amend Sections 56.10 and 56.11 of, and to add Section
56.07 to, the Civil Code, and to add Section 123111 to the Health and
Safety Code, relating to medical information.


	LEGISLATIVE COUNSEL'S DIGEST


   SB 1903, Speier.  Medical information:  requests for disclosure.
   Existing law, the Confidentiality of Medical Information Act,
provides that, except in specified circumstances, medical
information, as defined, may not be disclosed by providers of health
care, health care service plans, or contractors, as defined, without
the patient's written authorization.  Existing law also prohibits a
provider of health care, health care service plan, or contractor from
intentionally sharing, selling, or otherwise using any medical
information not necessary to provide health care services to the
patient, except as specified.  Existing law also prohibits a provider
of health care, a health care services plan, or a contractor from
further disclosing medical information to any person or entity that
is not engaged in providing direct health care services, as
specified.  A violation of the act resulting in economic loss or
personal injury to a patient is a misdemeanor and subjects the
violating party to liability for specified damages and administrative
fines and penalties.  For purposes of the act, "providers of health
care" includes corporations organized for the primary purpose of
maintaining medical information, as specified.
   This bill would make the provisions prohibiting sharing, selling,
or using medical information for purposes other than provision of
health care services applicable to corporations and their
subsidiaries and affiliates.  The bill would also require a valid
authorization for the release of medical information to a person or
entity not otherwise authorized by law to obtain such information.
Violation of these requirements resulting in economic loss would be a
misdemeanor.  By creating new crimes, the bill would create a
state-mandated local program. The bill would also require specified
corporations and entities that maintain medical profiles, summaries,
or information, except as specified, to provide the patient with a
copy thereof at no charge, upon request.
   Existing law provides that an adult patient shall be entitled to
inspect his or her patient records upon written request to the health
care provider.
   This bill would authorize an adult patient to prepare a specified
addendum to his or her patient records and require the health care
provider to attach that addendum to the patient's records.  The bill
would also specify that the health care provider shall not be liable
for the receipt and inclusion, in and of itself, of the contents of a
patient's addendum in the patient's records, as specified.
   This bill would incorporate additional changes to Section 56.10 of
the Civil Code proposed by AB 2414 and SB 2094, to be operative if
this bill and one or more of the other bills are enacted and become
effective on or before January 1, 2001, and this bill is enacted
last.
  The California Constitution requires the state to reimburse local
agencies and school districts for certain costs mandated by the
state.  Statutory provisions establish procedures for making that
reimbursement.
   This bill would provide that no reimbursement is required by this
act for a specified reason.


THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:


  SECTION 1.  Section 56.07 is added to the Civil Code, to read:
   56.07.  (a) Except as provided in subdivision (c), upon the
patient's written request, any corporation described in Section
56.06, or any other entity that compiles or maintains medical
information for any reason, shall provide the patient, at no charge,
with a copy of any medical profile, summary, or information
maintained by the corporation or entity with respect to the patient.

   (b) A request by a patient pursuant to this section shall not be
deemed to be an authorization by the patient for the release or
disclosure of any information to any person or entity other than the
patient.
   (c) This section shall not apply to any patient records that are
subject to inspection by the patient pursuant to Section 123110 of
the Health and Safety Code and shall not be deemed to limit the right
of a health care provider to charge a fee for the preparation of a
summary of patient records as provided in Section 123130 of the
Health and Safety Code.  This section shall not apply to a health
care service plan licensed pursuant to Chapter 2.2 (commencing with
Section 1340) of Division 2 of the Health and Safety Code or a
disability insurer licensed pursuant to the Insurance Code.  This
section shall not apply to medical information compiled or maintained
by a fire and casualty insurer or its retained counsel in the
regular course of investigating or litigating a claim under a policy
of insurance that it has written.  For the purposes of this section,
a fire and casualty insurer is an insurer writing policies that may
be sold by a fire and casualty licensee pursuant to Section 1625 of
the Insurance Code.
  SEC. 2.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, or health care service
plan, or contractor shall disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan without first obtaining an
authorization, except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, or other health care professionals or
facilities for purposes of diagnosis or treatment of the patient.
This includes, in an emergency situation, the communication of
patient information by radio transmission between emergency medical
personnel at the scene of an emergency, or in an emergency medical
transport vehicle, and emergency medical personnel at a health
facility licensed pursuant to Chapter 2 (commencing with Section
1200) of Division 2 of the Health and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, or any other person or entity
responsible for paying for health care services rendered to the
patient, to the extent necessary to allow responsibility for payment
to be determined and payment to be made.  If (A) the patient is, by
reason of a comatose or other disabling medical condition, unable to
consent to the disclosure of medical information and (B) no other
arrangements have been made to pay for the health care services being
rendered to the patient, the information may be disclosed to a
governmental authority to the extent necessary to determine the
patient's eligibility for, and to obtain, payment under a
governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, or persons or organizations insuring, responsible for, or
defending professional liability that a provider may incur, if the
committees, agents, plans, organizations, or persons are engaged in
reviewing the competence or qualifications of health care
professionals or in reviewing health care services with respect to
medical necessity, level of care, quality of care, or justification
of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of chronic disease management programs,
information may be disclosed to any entity contracting with a health
care service plan to monitor or administer care of enrollees for a
covered benefit, provided that the disease management services and
care are authorized by a treating physician.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
  SEC. 2.1.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, or other health care professionals or
facilities for purposes of diagnosis or treatment of the patient.
This includes, in an emergency situation, the communication of
patient information by radio transmission between emergency medical
personnel at the scene of an emergency, or in an emergency medical
transport vehicle, and emergency medical personnel at a health
facility licensed pursuant to Chapter 2 (commencing with Section
1250) of Division 2 of the Health and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, or any other person or entity
responsible for paying for health care services rendered to the
patient, to the extent necessary to allow responsibility for payment
to be determined and payment to be made.  If (A) the patient is, by
reason of a comatose or other disabling medical condition, unable to
consent to the disclosure of medical information and (B) no other
arrangements have been made to pay for the health care services being
rendered to the patient, the information may be disclosed to a
governmental authority to the extent necessary to determine the
patient's eligibility for, and to obtain, payment under a
governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, or persons or organizations insuring, responsible for, or
defending professional liability that a provider may incur, if the
committees, agents, plans, organizations, or persons are engaged in
reviewing the competence or qualifications of health care
professionals or in reviewing health care services with respect to
medical necessity, level of care, quality of care, or justification
of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician, or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend upon prayer or spiritual
means for healing in the practice of the religion of that church or
denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries or affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
  SEC. 2.2.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
                                            (4) By a board,
commission, or administrative agency pursuant to an investigative
subpoena issued under Article 2 (commencing with Section 11180) of
Chapter 2 of Part 1 of Division 3 of Title 2 of the Government Code.

   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractors, or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient.  This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1200) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor, or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made.  If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractors, or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law, nor shall
that information be further disclosed by the recipient in any way
that would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of chronic disease management programs,
information may be disclosed to any entity contracting with a health
care service plan to monitor or administer care of enrollees for a
covered benefit, provided that the disease management services and
care are authorized by a treating physician.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
  SEC. 2.3.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractor's or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient.  This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section  1250) of Division 2 of the
Health and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made.  If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractors or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law, nor shall
that information be further disclosed by the recipient in any way
that would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician, or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
  SEC. 3.  Section 56.11 of the Civil Code is amended to read:
   56.11.  Any person or entity that wishes to obtain medical
information pursuant to subdivision (a) of Section 56.10, other than
a person or entity authorized to receive medical information pursuant
to subdivision (b) or (c) of Section 56.10, shall obtain a valid
authorization for the release of this information.
   An authorization for the release of medical information by a
provider of health care, a health care service plan, or contractor
shall be valid if it:
   (a) Is handwritten by the person who signs it or is in typeface no
smaller than 8-point type.
   (b) Is clearly separate from any other language present on the
same page and is executed by a signature which serves no other
purpose than to execute the authorization.
   (c) Is signed and dated by one of the following:
   (1) The patient.  A patient who is a minor may only sign an
authorization for the release of medical information obtained by a
provider of health care, health care service plan, or contractor in
the course of furnishing services to which the minor could lawfully
have consented under Part 1 (commencing with Section 25) or Part 2.7
(commencing with Section 60).
   (2) The legal representative of the patient, if the patient is a
minor or an incompetent.  However, authorization may not be given
under this subdivision for the disclosure of medical information
obtained by the provider of health care, a health care service plan,
or a contractor in the course of furnishing services to which a minor
patient could lawfully have consented under Part 1 (commencing with
Section 25) or Part 2.7 (commencing with Section 60).
   (3) The spouse of the patient or the person financially
responsible for the patient, where the medical information is being
sought for the sole purpose of processing an application for health
insurance or for enrollment in a nonprofit hospital plan, a health
care service plan, or an employee benefit plan, and where the patient
is to be an enrolled spouse or dependent under the policy or plan.
   (4) The beneficiary or personal representative of a deceased
patient.
   (d) States the specific uses and limitations on the types of
medical information to be disclosed.
   (e) States the name or functions of the provider of health care,
health care service plan, or contractor that may disclose the medical
information.
   (f) States the name or functions of the persons or entities
authorized to receive the medical information.
   (g) States the specific uses and limitations on the use of the
medical information by the persons or entities authorized to receive
the medical information.
   (h) States a specific date after which the provider of health
care, health care service plan, or contractor is no longer authorized
to disclose the medical information.
   (i) Advises the person signing the authorization of the right to
receive a copy of the authorization.
  SEC. 4.  Section 123111 is added to the Health and Safety Code, to
read:
   123111.  (a) Any adult patient who inspects his or her patient
records pursuant to Section 123110 shall have the right to provide to
the health care provider a written addendum with respect to any item
or statement in his or her
records that the patient believes to be incomplete or incorrect.  The
addendum shall be limited to 250 words per alleged incomplete or
incorrect item in the patient's record and shall clearly indicate in
writing that the patient wishes the addendum to be made a part of his
or her record.
   (b) The health care provider shall attach the addendum to the
patient's records and shall include that addendum whenever the health
care provider makes a disclosure of the allegedly incomplete or
incorrect portion of patient's records to any third party.
   (c) The receipt of information in a patient's addendum which
contains defamatory or otherwise unlawful language, and the inclusion
of this information in the patient's records, in accordance with
subdivision (b), shall not, in and of itself, subject the health care
provider to liability in any civil, criminal, administrative, or
other proceeding.
   (d) Subdivision (f) of Section 123110 and Section 123120 shall be
applicable with respect to any violation of this section by a health
care provider.
  SEC. 5.  (a) Section 2.1 of this bill incorporates amendments to
Section 56.10 of the Civil Code proposed by both this bill and AB
2414.  It shall only become operative if (1) both bills are enacted
and become effective on or before January 1, 2001, (2) each bill
amends Section 56.10 of the Civil Code, and (3) SB 2094 is not
enacted or as enacted does not amend that section, and (4) this bill
is enacted after AB 2414, in which case Sections 2, 2.2, and 2.3 of
this bill shall not become operative.
   (b) Section 2.2 of this bill incorporates amendments to Section
56.10 of the Civil Code proposed by both this bill and SB 2094.  It
shall only become operative if (1) both bills are enacted and become
effective on or before January 1, 2001, (2) each bill amends Section
56.10 of the Civil Code, (3) AB 2414 is not enacted or as enacted
does not amend that section, and (4) this bill is enacted after SB
2094 in which case Sections 2, 2.1 and 2.3 of this bill shall not
become operative.
   (c) Section 2.3 of this bill incorporates amendments to Section
56.10 of the Civil Code proposed by this bill, AB 2414, and SB 2094.
It shall only become operative if (1) all three bills are enacted
and become effective on or before January 1, 2001, (2) all three
bills amend Section 56.10 of the Civil Code, and (3) this bill is
enacted after AB 2414 and SB 2094, in which case Sections 2,2.1 and
2.2 of this bill shall not become operative.
  SEC. 6.  No reimbursement is required by this act pursuant to
Section 6 of Article XIIIB of the California Constitution because the
only costs that may be incurred by a local agency or school district
will be incurred because this act creates a new crime or infraction,
eliminates a crime or infraction, or changes the penalty for a crime
or infraction, within the meaning of Section 17556 of the Government
Code, or changes the definition of a crime within the meaning of
Section 6 of Article XIIIB of the California Constitution.
